1695386 - Clean up BailoutKind::TooManyArgs

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P3)

Description

[Iain Ireland [:iain]]

Note: this bug is currently reserved for Outreachy applicants for the Spring/Summer 2021 cycle. If it has not been completed by the end of the application cycle, we will open it up.

Background

Warp, our optimizing compiler, speculatively optimizes functions based on the behaviour we have seen so far. If something changes, we may have to bail out. When we do so, we want to ensure that we don't make the same incorrect speculation again. To track this information, we give every MIR instruction that might bail out a BailoutKind, which tells us what to do if a bailout happens. (For more information, see this SMDOC comment.)

This Bug

To avoid allocating too much stack memory at once, we put a limit on the maximum number of arguments that can be pushed by a spread call (foo(...array)) or FunApply (foo.apply({}, array) in jitcode. If a function is called with too many arguments, we will bail out and call into C++ code to handle the call.

In some cases (like foo(...array)) we can hit this bailout without speculating. If this happens, to avoid getting stuck in endless bailout loops, we will disable Warp compilation for this function. This uses BailoutKind::TooManyArguments. Currently, we set that bailout kind for MIR instructions in their constructors. (Relevant searchfox results)

This is too pessimistic for FunApply. If we bail out because the array of arguments is too big, we can just not optimize the FunApply in CacheIR (see here), and we'll generate a regular call to the native FunApply function.

Instructions generated in WarpCachIRTranspiler.cpp don't need BailoutKind::TooManyArguments, because the BailoutKind::TranspiledCacheIR they are assigned here is good enough. Instead of setting BailoutKind::TooManyArguments in the constructor, we should call setBailoutKind on the relevant instructions when they are generated in WarpBuilder.cpp.

When you're done, you should be able to run the test suite (./mach jit-test) without any failures. (You will want to build SpiderMonkey with --enable-optimize while running the tests.)

Prerequisites

Before getting started, you'll want to ensure:

• you have a checkout of the Firefox source code
• you can build SpiderMonkey
• you have read this walkthrough about how development works in Firefox

Getting help

Leave comments on this bug for questions, or ask in #spidermonkey on chat.mozilla.org.

Comment 1

[pavel]

I can fix that but i need some guide

Comment 2

[Iain Ireland [:iain]]

pavel: Are you still working on this bug?

Comment 3

[Bukola Felicia Akinnadeju]

Attachment: Bug 1695386 - Clean up BailoutKind::TooManyArgs. r=iain

Comment 4

[mehaboob shariff]

Is anyone still working on this

Comment 5

[pavelp]

(In reply to mehaboob shariff from comment #4)

Is anyone still working on this

yep, i am

Comment 6

[pavel]

Attachment: Bug 1695386 - Clean up BailoutKind::TooManyArgs UPDATE r?iain

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9e1110b7f728
Clean up BailoutKind::TooManyArgs UPDATE r=iain

Comment 8

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/9e1110b7f728